Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2016-9074

Published: 16 November 2016

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Priority

Medium

Cvss 3 Severity Score

5.9

Score breakdown

Status

Package Release Status
nss
Launchpad, Ubuntu, Debian
upstream
Released (3.26.1)
precise
Released (2:3.26.2-0ubuntu0.12.04.1)
trusty
Released (2:3.26.2-0ubuntu0.14.04.3)
xenial
Released (2:3.26.2-0ubuntu0.16.04.2)
yakkety
Released (2:3.26.2-0ubuntu0.16.10.1)
zesty
Released (2:3.26.2-1ubuntu1)
Patches:
upstream: https://hg.mozilla.org/projects/nss/rev/d38536fcc726
upstream: https://hg.mozilla.org/projects/nss/rev/6883f1fc9129
upstream: https://hg.mozilla.org/projects/nss/rev/6ca604746182

Severity score breakdown

Parameter Value
Base score 5.9
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N